05/29 Fixed a shared item isn't auto updated when it's modified by owner

CLAUDE.md

@@ -444,7 +444,17 @@ The sharing key uses raw `SubtleCrypto` calls (not `SharingCrypto.decryptPrivate
 
 ### Shared item name encryption
 
-When creating a share, the client encrypts `item.name` with `SharingCrypto.encryptName(sharedKey, name)` → `enc_name`/`iv_name`. The server receives `item_name = item.item_type` (non-sensitive type label) for the `NOT NULL` column. On the recipient's inbox, `enc_name`/`iv_name` are stored in data attributes on the View button and decrypted client-side with `SharingCrypto.decryptName()` when the user clicks View. Legacy shares (pre-migration, no `enc_name`) fall back to showing `item_name` (the type string).
+When creating a share, the client encrypts `item.name` with `SharingCrypto.encryptName(sharedKey, name)` → `enc_name`/`iv_name`. The server receives `item_name = item.item_type` (non-sensitive type label) for the `NOT NULL` column. On the recipient's inbox, `enc_name`/`iv_name` are decrypted client-side with `SharingCrypto.decryptName()` when the user clicks View. Legacy shares (pre-migration, no `enc_name`) fall back to showing `item_name` (the type string).
+
+### Live sync of owner edits to accepted shares
+
+When the owner edits a vault item, `buildSharedUpdates(itemId, plainData, name)` re-encrypts the item for every accepted share using each recipient's ECDH public key, then POSTs all re-encrypted blobs in `shared_updates[]` inside `PUT /api/vault/<id>`. The server updates `enc_data`, `iv`, `enc_name`, `iv_name` on each matching `SharedItem` row and logs a `shared_item.update` audit entry.
+
+On the grantee side there are two paths:
+- **Vault list (main view):** `openFreshSharedDetail()` calls `loadSharedItemsForVault()` → re-fetches `/api/sharing/inbox` on every View click — always current.
+- **Sharing tab "View" button:** previously baked `enc_data`/`iv`/`enc_name`/`iv_name` into HTML `data-*` attributes at render time. Fixed to fetch `/api/sharing/inbox` fresh on every click, look up the share by ID, then decrypt the server's latest ciphertext. This prevents stale data if the sharing tab was already open when the owner edited.
+
+**Gotcha:** never read `data-enc` / `data-iv` / `data-owner-key` from the View button for decryption — those attrs may be stale. Always re-fetch from `/api/sharing/inbox`.
 
 ### Vault item tags
 
@@ -598,6 +608,7 @@ Audit log details **never** contain plaintext item names, shared item names, or
 | `auth.py`      | `auth.delete_account` / `auth.delete_account_failed`   | Deletion                       |
 | `auth.py`      | `auth.recovery_setup/failed/items_denied/success`      | Recovery                       |
 | `vault.py`     | `vault_item.create/update/delete`                      | CRUD (detail: type + id only)  |
+| `vault.py`     | `shared_item.update`                                   | Re-encrypted N accepted share copies when owner edits item |
 | `vault.py`     | `vault_item.export` / `vault_item.import`              | Import/Export                  |
 | `folders.py`   | `folder.create/update/delete`                          | Folder CRUD                    |
 | `sharing.py`   | `sharing_keys.create/update`                           | ECDH key setup                 |